The following table provides the supported upgrade paths from the earlier version of Cisco Secure Workload, 3.10.6.3 to the latest Cisco Secure Workload, 4.0.1.1.

Note	We recommend upgrading in the specified order without skipping any releases, unless otherwise specified.

For supported upgrade paths earlier than Cisco Secure Workload, 4.0.1.1, refer to Supported Upgrade Paths for Secure Workload.

Note	Due to some critical issues in the Secure Workload, Release 4.0.1.1, we recommend that you upgrade to 4.0.2.5 immediately after upgrading to 4.0.1.1. For more information about these issues, refer to the Open Issues section in Cisco Secure Workload Release Notes, Release 4.0.1.1.

Secure Workload clusters that run on physical hardware can be configured to use IPv6 in addition to IPv4 for certain communications to and from the clusters.

Guidelines

• Configure both A and AAAA DNS records for FQDN before enabling dual-stack mode for your cluster.

• External services such as NTP, SMTP, and DNS must be available over both IPv4 and IPv6, for redundancy purposes.

• To configure dual-stack mode for a cluster, ensure the following:

  • Each of the two cluster-leaf switches must have routable IPv6 addresses on two different networks for redundancy. Provide a default gateway for each network.

  • For 39RU clusters, a site-routable IPv6 network with space for at least 29 host addresses is required.

  • For 8RU clusters, a site-routable IPv6 network with space for at least 20 host addresses is required.

  • The first three host addresses of the site-routable IPv6 network are reserved for the Cisco Secure Workload cluster HSRP configuration and must not be used by any other devices.

Limitations

If you are considering enabling dual-stack mode, note these limitations:

• You can enable IPv6 connectivity only during initial deployment or upgrade to a major release. You cannot enable this feature during patch upgrades.

• Dual-stack mode is supported only on physical hardware or bare metal clusters.

• IPv6-only mode is not supported if you enable dual-stack mode.

• After you enable dual-stack mode for the cluster, the configuration remains dual stack.

• Enable dual-stack mode only for clusters that are not configured with Federation.

• The enforcement on AIX agents use only IPv4. Note that IPv4 is always enabled even if IPv6 is enabled.

If you have enabled IPv6:

• You can access the Secure Workload web interface using either IPv6 or IPv4.

• By default, software agents use IPv4 to connect to the cluster. To enable IPv6 communication with the cluster over IPv6, do this:

  1. On the Secure Workload web interface, from the navigation pane, choose Platform > Cluster Configuration.

  2. Configure the Sensor VIP FQDN setting. For more information, refer to the page-level help on the UI or the Cisco Secure Workload User Guide.

Licensing

Note

If your Secure Workload deployment does not currently have a valid Cisco Smart License (or is outside the evaluation period), you must register valid licenses before you upgrade. Site administration privileges are required to manage licenses. To view the status of your licenses, do this: In the Cisco Secure Workload web portal, choose Manage > Service Settings > Licenses. If your cluster license registration is out of compliance, a banner with the expiration date information is displayed on the UI. For information about obtaining and registering licenses, in the Secure Workload help menu, select Help > Page-Level Help and search for Smart Licensing.

Starting with Cisco Secure Workload, Release 3.10 and later, SMTP configuration settings are now available under the Email and Authentication tab. During the cluster setup, Site Admins use the SMTP Configuration switch to enable or disable the SMTP settings. However, note that you cannot modify these settings while the upgrade is in progress.

Secure Workload now supports configuration of SMTP using Microsoft Modern Authentication (OAuth) in addition to the basic SMTP authentication. This enhancement offers improved security through industry-standard OAuth 2.0 when connecting to Microsoft SMTP servers. For more information, see SMTP Server Configuration for Cluster and Site Configuration.

Note	Starting from Cisco Secure Workload, Release 3.8 and later, non-ASCII characters are not allowed in any text fields for Site configurations using the Cisco Secure Workload Setup UI.

This section explains the process of Site Admins setting up a site during the Secure Workload cluster set up.

• Under the General tab, change the SSH public key and click Next.

  Note

  Starting with Cisco Secure Workload, Release 3.10, the Email tab is renamed to Email and Authentication tab. SMTP configuration settings, previously located under the Services tab, are now found under the Email and Authentication tab. A new SMTP configuration switch appears in this tab; however, you cannot modify the settings during an upgrade.

• Under Email and Authentication, change the UI admin or the admin email address and click Next.

• (Optional) Under L3, enable the cluster to use IPv6 addresses in addition to IPv4 for certain cluster connectivity after the upgrade. To enable IPv6:

  1. Select the IPv6 check box.

  2. Enter IPv6 addresses in CIDR notation for both Leaf 1 and Leaf 2 switches.

  3. Enter the Leaf1 and Leaf2 IPv6 default gateway.

  4. Click Next.

  If you enable IPv6 on this page, you must also configure IPv6 fields on the Network page, described in the next step. For requirements and limitations on dual stack mode, see the Requirements and Limitations for Dual-Stack Mode (IPv6 Support) section.

• Under Network:

  • If necessary, change the values for CIMC Internal Network, CIMC Internal Network Gateway, DNS Resolver, and DNS Domain.

    Important

    Do not change or remove the existing External Network value. However, you can add more IPv4 networks.

  • If IPv6 is enabled on the L3 page, the IPv6 check box is automatically selected. To specify the IPv6 addresses that are reserved for Cisco Secure Workload, use the approved IPv6 addresses:

    1. Enter IPv6 External Network in CIDR notation.

    2. (Optional) To use IPv6 only for specified addresses, enter individual External IPv6 IPs.

• Under Service, change the NTP and SMTP values and click Next.

• Under Security, enable or disable Strong SSL Ciphers for Agent Connections and click Next. Note that the values entered for the UI, Advanced, and Recovery tabs cannot be changed.

• (Optional) Under Recovery, if the cluster is configured as a standby cluster, the cluster will deploy in standby mode, which includes reduced functionality (supports only warm standby mode).

• Click Continue.

  • The following checks are performed during the upgrade process to ensure:

    • the RPM versions are correct.

    • the cluster is healthy.

    • the site information you provided is valid.

    • the physical clusters are configured correctly and may be upgraded to a newer version of NX-OS software.

    • information fields are validated.

    • NTP is synchronized before deployment starts.

    • name node and secondary name node are not in a failed-over state.

    Note	On physical clusters, if switches need to be upgraded, the checks can take several minutes to an hour. After the checks are complete, an email with the subject is sent to the user: TETRATION CLUSTER MyCluster: Verify Token. Copy the token from the email and use it to continue with the upgrade.